968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420

Sharing

Copy URL Twitter E-mail

General

Target
968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420
Size 497KB
Sample260916-tkf1cssfpc
SHA256 968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420
MD5 3427fa5bb85408c1f70228f5a6a1dc08
SHA1 b92d0cd025d44bcd4888bc329153ad7ddf5f8794
SHA512 d9265086fb19588ef5b6889f6368b70260121fe16ca09eaa33f2c298a4047aa7f6f7c398ee6a2d11f79c94a5fb1f41691a58391c68788b40d7b5041819e96229
SSDEEP 6144:CL6Iw6xHORbTkWyIY5pqQxm8R3bjRNK617o41Nptp7Nu+QAf:CGqxHORbAWdY5pqsm8RvR37p7NuCf
TLSH
T102B485A0A5F8D8B7F37326713969B32050ABBA81275781CF354677A41BB37C0246CE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420

File Explorer

968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420

.exe 497KB

968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420

IMPHASH ca0ae9097f945e49dff379be5c119892
SHA256 968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420
MD5 3427fa5bb85408c1f70228f5a6a1dc08
SHA1 b92d0cd025d44bcd4888bc329153ad7ddf5f8794
SHA512 d9265086fb19588ef5b6889f6368b70260121fe16ca09eaa33f2c298a4047aa7f6f7c398ee6a2d11f79c94a5fb1f41691a58391c68788b40d7b5041819e96229
SSDEEP 6144:CL6Iw6xHORbTkWyIY5pqQxm8R3bjRNK617o41Nptp7Nu+QAf:CGqxHORbAWdY5pqsm8RvR37p7NuCf
TLSH
T102B485A0A5F8D8B7F37326713969B32050ABBA81275781CF354677A41BB37C0246CE5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ce:56:ff:88:a3:b1:33:74:2c:47:db:71:70:36:0b:04:ff:06:5c:c1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Chains

Oct 16, 2015

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 3, 2015 - Mar 3, 2026

Subject

CN=QFX Software Corporation,O=QFX Software Corporation,L=Ormond Beach,ST=FL,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d

Serial Number

11:21:51:d0:da:5c:b4:17:0d:0d:9c:b1:d6:a0:55:ce:f1:37

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 2, 2015 - May 2, 2016

Minor OS version

Major OS version

Entry point

73473

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\qzwang\Documents\workspace\InputSafe\winsrc\browser\InputSafeOmni\Release\KeyScrambler.pdb

keyscramblerie

KSOptions KSPromptForKey KSSetKeyInfo KSUpdate KSSetOption KSInit KSUninit

kernel32

GetModuleHandleExW OpenEventW FlushInstructionCache GetCurrentThreadId lstrlenW GetModuleHandleW InterlockedIncrement InterlockedDecrement lstrcmpiW SetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW CreateFileW MoveFileExW FindClose FindNextFileW FindFirstFileW ResetEvent SetEvent Sleep CreateEventW SetEndOfFile CreateFileA SetStdHandle GetProcAddress IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW IsValidCodePage GetOEMCP DeleteCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW LoadLibraryW SetConsoleCtrlHandler SetFilePointer ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP FatalAppExitA GetFileType SetHandleCount HeapSize HeapReAlloc GetStdHandle WriteFile GetCurrentProcess FreeLibrary OpenProcess WaitForSingleObject CloseHandle DeleteFileW WriteConsoleW LocalFree InitializeCriticalSectionAndSpinCount GetLastError LeaveCriticalSection VirtualAlloc EnterCriticalSection RaiseException InterlockedPopEntrySList InterlockedExchange InitializeCriticalSection EncodePointer DecodePointer RtlUnwind GetCurrentThread TlsFree TlsSetValue TlsGetValue TlsAlloc HeapDestroy HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCPInfo LCMapStringW WideCharToMultiByte GetStartupInfoW HeapSetInformation ExitProcess GetACP InterlockedCompareExchange InterlockedPushEntrySList HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree GetCommandLineW

user32

GetClassInfoExW LoadCursorW DispatchMessageW SetWindowLongW LoadBitmapW UpdateWindow SetWindowRgn MessageBoxW BroadcastSystemMessageW EndPaint BeginPaint CallWindowProcW GetParent GetWindow GetWindowRect MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos KillTimer SetTimer PostMessageW GetWindowLongW RegisterClassExW CreateWindowExW DestroyWindow CharNextW DefWindowProcW PeekMessageW GetMessageW TranslateMessage UnregisterClassA

gdi32

BitBlt SelectObject CreateCompatibleDC DeleteObject GetObjectW CreateRoundRectRgn DeleteDC

advapi32

RegOpenKeyExW GetSecurityDescriptorSacl RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoTaskMemFree CoUninitialize CoInitialize CoTaskMemRealloc CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathCombineW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

968753980efecd97f176ddf683305229edf884c140eb3d66bb6bab12d0a86420

PE Signature issue

keyscramblerie

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic